Malicious Archive / .ZIP — malware analysis report

Static analysis result for SHA-256 d899d52e33145872…

MALICIOUS

Archive / .ZIP

10.45 MB First seen: 2026-05-13
MD5: 60a5e99a306f05167367ed01ca93423a SHA-1: ad7c59b2a3201c89646fca3f8d20631733f357c5 SHA-256: d899d52e33145872a2ff1255ae74fcfd52ad3b2429b928affa0b8bbf7953d3cd
64 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The primary finding is a malicious PDF file embedded within a ZIP archive, indicated by the ARCHIVE_CHILD_MALICIOUS heuristic. The PDF contains numerous unknown URLs, suggesting it is designed to redirect users to malicious websites for phishing or scam purposes. The archive also exceeded its entry limit, indicating a potentially large and complex malicious structure.

Heuristics 3

  • Archive contains malicious member critical ARCHIVE_CHILD_MALICIOUS
    At least one extracted archive member was classified as malicious. The archive is a transport wrapper for that payload.
  • Archive entry limit reached (50) info ARCHIVE_LIMIT
    Only the first 50 files were scanned.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hdewptwhdve.com/nte/avorp1aabbcc.html/eU230d9c2eH7c4387a4V0100f060006Ree983873102T8f5c5f03201l0019Kf9e4daa7 In document body
    • http://defase.info/page/hotweb.php/n002106208r0409R673dbaccX37fc1386Y2b3c746dZ0100f070In document body
    • http://vquze-a.info/cgi-bin/login.aspx/z003106201r0409Ra80e1e1dXbc5d783cY226783f9Z0100f070In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5327f1d8V0100f060006Rb223753a102T7ecf3dd8203l0019In document body
    • http://state-me.net/e/load.php?spl=pdf_newIn document body
    • http://state-me.net/e/load.php?spl=pdf_packIn document body
    • http://diaiscjdthr.com/nte/GNH4.html/eU230d9c2eH1b2f3ee7V0100f060006R63e3ac3e102T4e609842203l000cKf8f093d3In document body
    • http://bingpowered.com/tre/lena.py/yH6e26ef3dV03008f36002R3c880b17102T1d958ef9Q000002f3901801F0035010aJ00000000l0409In document body
    • http://beancountercity.in/cgi-bin/uiq/eH22b94c37V0100f060006Rc39f5f81105Tcf31bac7203l0019In document body
    • http://googleinru.in/cgi-bin/etn/z006106201r0019R2b2003d0Xb433bb53Y49d94a7fZ0100f060In document body
    • http://oyunland.org/fragus/dhlprt2.exeIn document body
    • http://oyunland.org/fragus/click.php?r=In document body
    • http://oyunland.org/fragus/iopqst2.exeIn document body
    • http://oyunland.org/fragus/glpuv2.exeIn document body
    • http://06.autdh.in/x/l.php?s=printf_&In document body
    • http://06.autdh.in/x/l.php?s=email_&In document body
    • http://06.autdh.in/x/l.php?s=gicon_&In document body
    • http://06.autdh.in/x/l.php?s=newp_&In document body
    • http://beancountercity.in/cgi-bin/uiq/eH4f46acadV0100f060006R5091e1eb102T8de7a4d6201l0019In document body
    • http://mysterio.info/cgi-bin/worker/z002106201r0019Re60d3c5cXae8a474fY6b67bfddZ0100f060In document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019R0f1ff7afX916abdb8Y0a95c2c5Z0100f060In document body
    • http://greenlpl.com/exe.php?spl=PDF%20(printdIn document body
    • http://greenlpl.com/exe.php?spl=PDF%20(EmailInfoIn document body
    • http://greenlpl.com/exe.php?spl=PDF%20(util_printfIn document body
    • http://greenlpl.com/exe.php?spl=PDF%20(GetIconIn document body
    • http://berqakdd.info/cgi-bin/class.phtml/n002106201r0409Rd4b5a35dX7cfee4a9Y3b3d9488Z0100f070In document body
    • http://ajnuocfdrukv.com/nte/TREST1.php/eH6f47b3c0V0100f060006R95f9a935102T96a23708201l0019K1d3f23fcIn document body
    • http://phjuibqpoxk.com/nte/UTAN.py/yH778e92b5V0100f060006R3bc3932a102T7222694b201l0019In document body
    • http://click-reklama.com/cgi-bin/plt/z002106201r0019R1834912cX5be1984fY3f201ec1Z0100f060In document body
    • http://ajnuocfdrukv.com/nte/trest1%20.asp/eH5e2300e8V0100f060006R98e51d2b102T67188dc4201l0019K353b1b33In document body
    • http://beancountercity.in/cgi-bin/uiq/eH6e42e884V0100f060006Rdb36bc39102T4ce8c9d5203l0019In document body
    • http://fragus-v1-1.cn/ads/nsy3.exeIn document body
    • http://fragus-v1-1.cn/ads/adn3.exeIn document body
    • http://fragus-v1-1.cn/ads/ceilqrvyz3.exeIn document body
    • http://googleinru.in/cgi-bin/etn/z002106201r0019Rca134428X36e9966fY5bbeeca5Z0100f060In document body
    • http://beancountercity.in/cgi-bin/uiq/eH5209d013V0100f060006R97f3b4e5102T65c198c3203l0019In document body
    • http://click-reklama.com/cgi-bin/plt/z006106201r0019Rbcf80bd0X50b6a476Y42c9762fZ0100f060In document body
    • http://www.xfa.org/schema/xfa-template/2.5/In document body
    • http://ns.adobe.com/xdp/In document body
    • http://www.xfa.org/schema/xci/1.0/In document body
    • http://www.xfa.org/schema/xfa-data/1.0/In document body
    • http://www.xfa.org/schema/xfa-form/2.8/In document body
    • http://ns.adobe.com/xtd/In document body
    • http://ns.adobe.com/xfdf/In document body
    • http://limon4ik.myftp.biz/eleon/getexe.php?spl=pdf_oldIn document body
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document body
    • http://ns.adobe.com/xap/1.0/In document body
    • http://purl.org/dc/elements/1.1/In document body
    • http://ns.adobe.com/xap/1.0/mm/In document body
    • http://ns.adobe.com/pdf/1.3/In document body
    +5 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.